njrat | 3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e

General

Target

3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
Size

126KB
MD5

908eba5a2eb01adb8dec24796369a583
SHA1

390772bf93171a02e4d22b8c262854ffbd1cd132
SHA256

3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e
SHA512

1dbfbe2feb32ec8bb5c3f297a7e1a56c0df5bf7bbed4f3bdc79eddd2c77664ba647a493c28837e8fd558615026c1dbddf5627b0f7747409d173a9c55e48e4752

Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

@ WeSt - HaCkInG K.S.A @

C2

w187.ddns.net:22

Mutex

Intel HD Graphics Drivers for Windows(R)

Attributes

reg_key
Intel HD Graphics Drivers for Windows(R)
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

pid process

968 Intel HD Graphics Drivers for Windows(R).exe
952 Intel HD Graphics Drivers for Windows(R).exe

pid	process
968	Intel HD Graphics Drivers for Windows(R).exe
952	Intel HD Graphics Drivers for Windows(R).exe

Drops startup file 4 IoCs

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk	Intel HD Graphics Drivers for Windows(R).exe

Loads dropped DLL 2 IoCs

Processes:

3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exeIntel HD Graphics Drivers for Windows(R).exe

pid process

1324 3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
968 Intel HD Graphics Drivers for Windows(R).exe

pid	process
1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
968	Intel HD Graphics Drivers for Windows(R).exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Intel HD Graphics Drivers for Windows(R).exeIntel HD Graphics Drivers for Windows(R).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R) = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Intel HD Graphics Drivers for Windows(R).URL"	Intel HD Graphics Drivers for Windows(R).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel HD Graphics Drivers for Windows(R)2 = "C:\\Users\\Admin\\AppData\\Roaming\\Intel HD Graphics Drivers for Windows(R).exe"	Intel HD Graphics Drivers for Windows(R).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process
Token: SeDebugPrivilege	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
Token: 33	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
Token: SeIncBasePriorityPrivilege	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
Token: SeDebugPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe
Token: 33	952	Intel HD Graphics Drivers for Windows(R).exe
Token: SeIncBasePriorityPrivilege	952	Intel HD Graphics Drivers for Windows(R).exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exeIntel HD Graphics Drivers for Windows(R).exe

description	pid	process	target process
PID 1324 wrote to memory of 968	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1324 wrote to memory of 968	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1324 wrote to memory of 968	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 1324 wrote to memory of 968	1324	3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe	Intel HD Graphics Drivers for Windows(R).exe
PID 968 wrote to memory of 952	968	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 968 wrote to memory of 952	968	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 968 wrote to memory of 952	968	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 968 wrote to memory of 952	968	Intel HD Graphics Drivers for Windows(R).exe	Intel HD Graphics Drivers for Windows(R).exe
PID 968 wrote to memory of 1376	968	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 968 wrote to memory of 1376	968	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 968 wrote to memory of 1376	968	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe
PID 968 wrote to memory of 1376	968	Intel HD Graphics Drivers for Windows(R).exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1376 attrib.exe

pid	process
1376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe
"C:\Users\Admin\AppData\Local\Temp\3a257336a2fd2160305094d425c7426dc07b5aa311eb7e31d5ac5d71d2cf8d4e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
"C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe"
3⤵
- Views/modifies file attributes
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel HD Graphics Drivers for Windows(R).lnk
MD5
5f14bdcc67d5f5a4a05e8c360ceceeb3

SHA1
5db8d7a63f4e877ecc9fd3f5bcf929b6ac216e2a

SHA256
1d47d4a6cb80db37332277c55dc5c39c60fba08fbe508087892e8f8e9148d139

SHA512
664ab91773d0fa95664f1a2b100a96aa33ee241abd0a52ac030f0483c31bd40afe03bad268cccf3d876bd35af993f5e95b22b10c13069161568c7d82a0cb17fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Intel HD Graphics Drivers for Windows(R).lnk
MD5
f2c1b6c91fadf5fd70bbb605cbf27e7d

SHA1
9a01eb3a675a8a51814905b0dde35336fb7d41f1

SHA256
d282fa7eddb517c9429b79d6a17d786727f53f729fa24c6236b8bdaf54562ab1

SHA512
64040036fbb35286a80d808f081c9441182839a192622029781d160885dabab5fc78e49e561fe12c26c76857532f04eca94c6285b05613c33ffbf582db8903c5

Download Submit
\Users\Admin\AppData\Local\Temp\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
\Users\Admin\AppData\Roaming\Intel HD Graphics Drivers for Windows(R).exe
MD5
f19f7b77300d578fe7f0304ee15bfae3

SHA1
89f17fcbf414876b65e555d8cf51ab8db4db132c

SHA256
7e9b32e715ed33aa05dbcf577876933ee43a0632ffcd95a50b23d612d82a88d1

SHA512
167c1c0e40105556068675f62fd06131864e7fa813d0575882c6d5ac60812ef42a348ee78d3fe11348fe1561e8beda72440030daaca1401b1ed314d70ffa128d

Download Submit
memory/952-64-0x0000000000000000-mapping.dmp

Download
memory/952-71-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/968-62-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/968-61-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/968-58-0x0000000000000000-mapping.dmp

Download
memory/1324-54-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1324-56-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/1376-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads